Encryption at rest
Per-workspace AES-256 keys. Keys never leave the encryption boundary.
Security
Security posture for AI execution.
We treat AI payloads as the most sensitive data we touch — they include unsent customer-facing copy, internal prompts, and operator decisions. Here is how the platform handles them.
Controls
Encryption in transit
TLS 1.3 only. HSTS preloaded. Certificate pinning available on enterprise.
Tenant isolation
Per-workspace policy versions and rate limits. No cross-tenant fan-out paths.
Authentication
Email + OAuth (Google, GitHub). OIDC SSO for enterprise. Forced password reset for invitations.
Authorization
Workspace-scoped roles (Owner, Admin, Reviewer, Developer, Billing) plus platform Super Admin.
Audit
Immutable rows on every gate decision, dispatch, and admin action. Exportable on demand.
Data residency
US default. EU and APAC on enterprise plans. Static residency per workspace.
Rate limiting
Per-workspace + per-key quotas. Plan-based ceilings to prevent runaway costs.
Secrets handling
Provider tokens and signing keys stored encrypted; rotation through dashboard or API.
Compliance status
Encryption & audit logging
Data in transit and at rest protected; privileged actions and pipeline changes written to an audit trail.
VerifiedGDPR alignment
Data handling patterns designed for GDPR workflows.
VerifiedRole-based access
Access is scoped to least privilege and audited actions.
VerifiedDPA templates
Standard DPA and sub-processor materials for enterprise procurement; execute via [email protected].
Verified